In the Linux kernel, sock_map_alloc() accepts any unsigned 32‑bit value for the sockmap size (max_entries) without enforcing an upper bound of INT_MAX. When a map is created with max_entries set to 0xffffffff, the kernel may allocate several gigabytes of memory. The free routine sock_map_free() iterates over the allocated array with a signed 32‑bit counter; as the counter overflows, it writes to a negative offset far outside the bounds of the allocation, causing an out‑of‑bounds write that can corrupt arbitrary kernel memory or trigger a crash.

All Linux kernel releases that do not yet include the patch adding the INT_MAX check on sock_map_alloc® are affected. The vulnerability applies to the core kernel code handling BPF sockmaps and is thus relevant to any payload that can load a BPF program to create such a map.

The flaw is a classic out‑of‑bounds memory write (CWE-124) stemming from an unchecked integer overflow. Exploitation requires the ability to load a BPF program and specify a sockmap size exceeding INT_MAX, a capability that is normally restricted to privileged users or applications with BPF access. The direct impact is memory corruption, which could lead to a kernel panic or arbitrary data modification; however, the CVSS score of 4.1 and the EPSS score of <1% suggest a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog.